CVE-2017-5754

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

• ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
• AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

67.40% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 99.3% of scored records. A rank, not a probability.

NVD base score

5.6 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2018-01-04 13:00Z8 YR AGO

Last updated

2026-05-28 17:53Z5 MO AGO

Reserved

2017-02-01

Assigning CNA

intel

Record state

PUBLISHED

Severity

Medium (CVSS 5.6)

CNA CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Weaknesses

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorClass
• CWE-208Observable Timing DiscrepancyBase

Data version

5.2

Document digest

cc031307a1e4a3cb2c8f17ceb72d700bab2780e7657ad86608a4c655cf481279

• nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4609x_refsource_CONFIRM
• usn.ubuntu.comUSN-3523-1https://usn.ubuntu.com/3523-1/vendor-advisoryx_refsource_UBUNTU
• usn.ubuntu.comUSN-3525-1https://usn.ubuntu.com/usn/usn-3525-1/vendor-advisoryx_refsource_UBUNTU
• www.codeaurora.orghttps://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletinx_refsource_CONFIRM
• security.gentoo.orgGLSA-201810-06https://security.gentoo.org/glsa/201810-06vendor-advisoryx_refsource_GENTOO
• www.debian.orgDSA-4082https://www.debian.org/security/2018/dsa-4082vendor-advisoryx_refsource_DEBIAN
• support.citrix.comhttps://support.citrix.com/article/CTX234679x_refsource_CONFIRM
• usn.ubuntu.comUSN-3540-2https://usn.ubuntu.com/3540-2/vendor-advisoryx_refsource_UBUNTU
• usn.ubuntu.comUSN-3522-3https://usn.ubuntu.com/3522-3/vendor-advisoryx_refsource_UBUNTU
• access.redhat.comhttps://access.redhat.com/security/vulnerabilities/speculativeexecutionx_refsource_CONFIRM
• lists.debian.org[debian-lts-announce] 20180107 [SECURITY] [DLA 1232-1] linux security updatehttps://lists.debian.org/debian-lts-announce/2018/01/msg00004.htmlmailing-listx_refsource_MLIST
• portal.msrc.microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180002x_refsource_CONFIRM
• usn.ubuntu.comUSN-3597-1https://usn.ubuntu.com/3597-1/vendor-advisoryx_refsource_UBUNTU
• lists.opensuse.orgSUSE-SU-2018:0012http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgSUSE-SU-2018:0011http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlvendor-advisoryx_refsource_SUSE
• nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4611x_refsource_CONFIRM
• security.googleblog.comhttps://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.htmlx_refsource_MISC
• cert.vde.comhttps://cert.vde.com/en-us/advisories/vde-2018-002x_refsource_CONFIRM
• www.debian.orgDSA-4120https://www.debian.org/security/2018/dsa-4120vendor-advisoryx_refsource_DEBIAN
• support.f5.comhttps://support.f5.com/csp/article/K91229003x_refsource_CONFIRM
• usn.ubuntu.comUSN-3524-2https://usn.ubuntu.com/usn/usn-3524-2/vendor-advisoryx_refsource_UBUNTU
• www.debian.orgDSA-4078https://www.debian.org/security/2018/dsa-4078vendor-advisoryx_refsource_DEBIAN
• source.android.comhttps://source.android.com/security/bulletin/2018-04-01x_refsource_CONFIRM
• lists.opensuse.orgopenSUSE-SU-2018:0022http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.htmlvendor-advisoryx_refsource_SUSE
• access.redhat.comRHSA-2018:0292https://access.redhat.com/errata/RHSA-2018:0292vendor-advisoryx_refsource_REDHAT
• xenbits.xen.orghttp://xenbits.xen.org/xsa/advisory-254.htmlx_refsource_CONFIRM
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20180104-0001/x_refsource_CONFIRM
• www.synology.comhttps://www.synology.com/support/security/Synology_SA_18_01x_refsource_CONFIRM
• www.arubanetworks.comhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-001.txtx_refsource_CONFIRM
• help.ecostruxureit.comhttps://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0x_refsource_CONFIRM
• developer.arm.comhttps://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityx_refsource_CONFIRM
• www.kb.cert.orgVU#584653http://www.kb.cert.org/vuls/id/584653third-party-advisoryx_refsource_CERT-VN
• usn.ubuntu.comUSN-3522-2https://usn.ubuntu.com/usn/usn-3522-2/vendor-advisoryx_refsource_UBUNTU
• www.kb.cert.orgVU#180049https://www.kb.cert.org/vuls/id/180049third-party-advisoryx_refsource_CERT-VN
• usn.ubuntu.comUSN-3583-1https://usn.ubuntu.com/3583-1/vendor-advisoryx_refsource_UBUNTU
• cert.vde.comhttps://cert.vde.com/en-us/advisories/vde-2018-003x_refsource_CONFIRM
• help.ecostruxureit.comhttps://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixesx_refsource_CONFIRM
• support.hpe.comhttps://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03805en_usx_refsource_CONFIRM
• www.mitel.comhttps://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0001x_refsource_CONFIRM
• support.hpe.comhttps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03871en_usx_refsource_CONFIRM
• www.suse.comhttps://www.suse.com/c/suse-addresses-meltdown-spectre-vulnerabilities/x_refsource_CONFIRM
• support.citrix.comhttps://support.citrix.com/article/CTX231399x_refsource_CONFIRM
• www.securityfocus.com102378http://www.securityfocus.com/bid/102378vdb-entryx_refsource_BID
• security.freebsd.orgFreeBSD-SA-18:03https://security.FreeBSD.org/advisories/FreeBSD-SA-18:03.speculative_execution.ascvendor-advisoryx_refsource_FREEBSD
• aws.amazon.comhttps://aws.amazon.com/de/security/security-bulletins/AWS-2018-013/x_refsource_CONFIRM
• www.securityfocus.com106128http://www.securityfocus.com/bid/106128vdb-entryx_refsource_BID
• blog.mozilla.orghttps://blog.mozilla.org/security/2018/01/03/mitigations-landing-new-class-timing-attack/x_refsource_CONFIRM
• www.securitytracker.com1040071http://www.securitytracker.com/id/1040071vdb-entryx_refsource_SECTRACK
• usn.ubuntu.comUSN-3597-2https://usn.ubuntu.com/3597-2/vendor-advisoryx_refsource_UBUNTU
• nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4614x_refsource_CONFIRM
• lists.opensuse.orgSUSE-SU-2018:0010http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.htmlvendor-advisoryx_refsource_SUSE
• tools.cisco.com20180104 CPU Side-Channel Information Disclosure Vulnerabilitieshttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180104-cpusidechannelvendor-advisoryx_refsource_CISCO
• usn.ubuntu.comUSN-3523-2https://usn.ubuntu.com/usn/usn-3523-2/vendor-advisoryx_refsource_UBUNTU
• usn.ubuntu.comUSN-3516-1https://usn.ubuntu.com/usn/usn-3516-1/vendor-advisoryx_refsource_UBUNTU
• usn.ubuntu.comUSN-3541-2https://usn.ubuntu.com/3541-2/vendor-advisoryx_refsource_UBUNTU
• googleprojectzero.blogspot.comhttps://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.htmlx_refsource_MISC
• support.lenovo.comhttps://support.lenovo.com/us/en/solutions/LEN-18282x_refsource_CONFIRM
• meltdownattack.comhttps://meltdownattack.com/x_refsource_MISC
• lists.opensuse.orgopenSUSE-SU-2018:0023http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.htmlvendor-advisoryx_refsource_SUSE
• nvidia.custhelp.comhttp://nvidia.custhelp.com/app/answers/detail/a_id/4613x_refsource_CONFIRM
• usn.ubuntu.comUSN-3522-4https://usn.ubuntu.com/3522-4/vendor-advisoryx_refsource_UBUNTU
• www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlx_refsource_MISC
• www.arubanetworks.comhttp://www.arubanetworks.com/assets/alert/ARUBA-PSA-2019-003.txtx_refsource_CONFIRM
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfx_refsource_CONFIRM
• www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
• cdrdv2.intel.comhttps://cdrdv2.intel.com/v1/dl/getContent/685358x_refsource_CONFIRM